I read about the release of a free dataset of malware related DNS queries called "Predict". A researcher or network security team can download or query this data set and use it to identify malware communication using DNS. Commercial vendors are already providing such services.
I know of two ways that malware might use DNS.
- Look up the address of a web site it is supposed to communicate with for command and control purposes.
- Use DNS itself to tunnel.
It seems like the dataset in the news article could protect against both.
In that first use, the malware program generates a number of domain names and queries each of them until one gets resolved to an IP address. The bot then contacts the IP address of the command and control server. This was a handy way to 1) Not reveal specific IP addresses in the malware itself. 2) recover if a particular Command and Control server was taken down (or blocked by the network admins).
DNS in the second use is harder to stop because it communicates via DNS itself instead of TCP/IP. Using a DNS server to try and filter traffic like this might be impractical.
So, cooperation like the "Predict" dataset makes malware use of DNS more risky because it will, on a daily basis, collect tens of thousands DNS queries and inform the world. It won't find them all, of course, but probably enough to make use of DNS more risky.
So, knowing this, why use DNS at all? Wouldn't it be easier and safer from the malware's point of view for it to simply contact one or more direct IP addresses instead of using DNS? Why not just skip registering domains and just use IP addresses that blink in and out of existence and serve the same purpose? Perhaps the problem of slowing down DNS by inpspecting DNS traffic still prevent full use of a dataset like "Predict"?
www.command.example.com CNAME attack-target.google.com.example.com